Drupal Clean RESTful CVE-2026-15087

Exploitation requires the Clean RESTful Drupal contributed module to be installed and enabled on the target Drupal site. The CVSS vector PR:H indicates the attacker must already possess high-privilege credentials (such as a Drupal administrator account) prior to exploitation - unauthenticated or low-privilege remote attackers are not within scope based on available vector data. AC:H signals that non-trivial conditions must be met, likely a specific API endpoint, request format, or site configuration, though the exact trigger is not specified in the available description text and should be confirmed against the vendor advisory at https://www.drupal.org/sa-contrib-2026-078. Exploitation is further limited by the non-automated nature (SSVC: Automatable = no), meaning bulk scanning and opportunistic mass exploitation are unlikely. No availability impact is possible (A:N). The primary limiting factors are the prerequisite of high-privilege Drupal access, the high attack complexity, and the niche deployment footprint of this contributed module.

The composite risk picture here is nuanced and contains an internal tension worth flagging. CVSS scores this at 5.9 (Medium) with AC:H and PR:H, which substantially limits practical exploitability despite the C:H/I:H impact. EPSS at 0.24% (15th percentile) independently confirms that exploitation in the wild is very unlikely based on current signals. SSVC classifies exploitation as 'none' and automatable as 'no', reinforcing that no weaponized, mass-exploitation tooling has emerged. However, SSVC's 'Technical Impact: total' rating acknowledges that a successful exploit fully compromises the confidentiality and integrity of the affected system. The core tension is this: CWE-287 (authentication bypass) combined with PR:H is architecturally unusual - authentication bypasses typically function precisely because they do not require prior high privileges. This may indicate that the bypass operates within a privileged session context (e.g., an admin-authenticated attacker bypassing additional authorization checks) or that specific high-privilege configuration steps are needed to trigger the flaw. Security teams should verify with the Drupal SA advisory at drupal.org/sa-contrib-2026-078 whether PR:H truly reflects the attack model or is a scoring artifact. Given the low EPSS, absence from KEV, AC:H complexity barrier, and niche module footprint, this is a medium-priority patching task - not an emergency, but should be addressed in the normal patch cycle.

An attacker holding a high-privilege Drupal account (such as an administrator) submits a crafted REST API request to an endpoint managed by the Clean RESTful module, exploiting the improper authentication logic to bypass expected authorization checks and access or modify Drupal content or configuration data beyond their intended permissions. The AC:H complexity requirement means the attacker likely needs to satisfy specific conditions - such as a particular API request structure, timing, or configuration state - before the bypass succeeds. No public proof-of-concept code has been identified at time of analysis, meaning exploitation currently requires independent vulnerability research or insider knowledge of the flaw.